Stop caching authenticated pages

cache-auth-page

A page carrying session data without no-store can be kept by a CDN or proxy and handed to the next visitor. Mark authenticated responses private.

Why this matters

A page with authentication data (cookies or auth headers) doesn't prevent shared caching. Proxies or CDNs could store and serve your users' private sessions to other visitors.

Your stack

CDN and edge

Cloudflare

Web servers

Nginx

Frameworks

Express Django

Cloudflare

1 Create a Cache Rule to bypass cache for authenticated paths
2 Or set Cache-Control: private at the origin

Cloudflare docs

Express

1 Set Cache-Control: no-store on authenticated responses

javascript

app.use('/app', (req, res, next) => {
  res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, private');
  next();
});

Does your app still have this?

Scan your domain